Supabase tables without row-level security
The anon key in the browser can read tables that were meant to stay private.
Who this is for
Lovable, Bolt, Cursor, and v0 apps that generated Supabase tables and never turned on RLS.
What AppPulse does
If the page contains a Supabase anon key, we send read-only GETs. First the OpenAPI listing, then at most one row from each listed table. We never insert, update, or delete. A service-role key in the bundle is reported on its own and is not used.
Why it matters
The anon key is supposed to be public. The policies are what keep customer rows private. An empty table with RLS off becomes a public table the moment you insert a row.
What to tell your AI tool
Enable row level security on every public table and add policies that use auth.uid(). Rotate the service role key if it ever shipped to the browser.